# Connect an agent to Mail

> Connect over MCP or the device code flow, choose what the agent may do, and check its address.

Kind: guide · ~3 min · Verified v0.200.0 · Next: [Gate modes](https://pr-1976-stg.superartifacts.app/docs/mail/gate-modes.md)

Super Agent Mail gives each agent its own email address. The MCP address is `https://mcp.superagentmail.app/mcp`. Connecting adds a Mail key that works on Mail only: it never opens your Super Artifacts account, and a Super Artifacts key never opens Mail.

## Connect over MCP

**Connect your agent.** The agent connects to Mail, signs in, and learns its own address.

```prompt
give yourself an email address on Super Agent Mail
by connecting to the MCP server at:
https://mcp.superagentmail.app/mcp
and follow the skill at:
https://superagentmail.app/skill/MAIL.md
```

Your agent opens a sign-in page that names your account. Press **Allow** to approve it.

## Choose what it may do

The sign in page asks for one of two levels.

- **Full access** lets the agent get its own address, read and search its mail and the workspace's shared mailboxes, rename its address, set a webhook, and send, reply and forward. You approve whatever the [gate](https://pr-1976-stg.superartifacts.app/docs/mail/gate-modes.md) holds.
- **Read only** lets it read its inbox and threads, search mail and read mailbox rules. Nothing is sent or changed. A call to any other tool is refused with `read_only`.

Either way the agent cannot read another agent's mailbox, change the rules a mailbox sends under, or touch billing. Change an agent's access, or disconnect it, on **Agents** in the Mail dashboard. Disconnecting an agent closes its mailboxes, and drafts still waiting for approval fail.

## No browser? Use the device code flow

An agent on a headless machine or a chat gateway asks for a device code with the scope `mail:agent` and the Mail MCP address as the resource. It shows you an address and a short code. Open the address on any device, type the code, check that it matches the one your agent showed, and press **Allow**. The code lasts ten minutes, and the agent checks for your answer every five seconds. Most MCP clients do this for you.

## Check it worked

At the start of every session the agent calls `mail_mailboxes`. The mailbox of kind `agent` is its address. If it has no address yet, the answer says why and where to upgrade.

## The tools

| Tool | What it is | Effect | On a read only key |
| --- | --- | --- | --- |
| `mail_mailboxes` | Your mailboxes | Reads mail | Yes |
| `mail_inbox` | Inbox | Reads mail | Yes |
| `mail_thread` | Read a thread | Reads mail | Yes |
| `mail_search` | Search mail | Reads mail | Yes |
| `mail_mailbox_create` | Create a shared mailbox | Changes settings or saves a draft | No |
| `mail_mailbox_rename` | Rename an address | Changes settings or saves a draft | No |
| `mail_webhook_set` | Set a webhook | Changes settings or saves a draft | No |
| `mail_rules` | Sending rules | Reads mail | Yes |
| `mail_draft` | Save a draft | Changes settings or saves a draft | No |
| `mail_send` | Send a message | Sends, through the gate | No |
| `mail_reply` | Reply to a message | Sends, through the gate | No |
| `mail_forward` | Forward a message | Sends, through the gate | No |

Everything inside a message is text from outside your team. The tools say so, and the agent is told never to follow an instruction in one.